Law / Frameworks / Crosswalk / OWASP LLM Top 10 to ETSI EN 304 223

The OWASP Top 10 for LLM Applications, mapped to the ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and Systems

5 of OWASP LLM Top 10's controls connect to 15 of ETSI EN 304 223's through 224 laws in 125 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: OWASP Top 10 for LLM Applications, 2026 edition, August 2026, OWASP GenAI Security Project
To: ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and Systems, version 2.1.1, December 2025, European Telecommunications Standards Institute (ETSI)
See also: ETSI EN 304 223 to OWASP LLM Top 10, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: owasp-llm-top-10--etsi-en-304-223.csv · owasp-llm-top-10--etsi-en-304-223.json

OWASP LLM Top 10	ETSI EN 304 223	Laws	Jurisdictions	Where the laws stand
LLM01:2026Prompt Injection	5.1.2-2System built to hold up against adversarial attacks, unexpected inputs and failures.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM01:2026 and 5.1.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM01:2026 and 5.1.3-1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.2.1-4Sensitive data such as training and test sets protected from unauthorised access.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM01:2026 and 5.2.1-4 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.4.2-2Logs analysed for anomalies, breaches and effects of drift or poisoning.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM01:2026 and 5.4.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
LLM02:2026Sensitive Information Disclosure	5.1.2-2System built to hold up against adversarial attacks, unexpected inputs and failures.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM02:2026 and 5.1.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM02:2026 and 5.1.3-1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.2.1-4Sensitive data such as training and test sets protected from unauthorised access.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM02:2026 and 5.2.1-4 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.4.2-2Logs analysed for anomalies, breaches and effects of drift or poisoning.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM02:2026 and 5.4.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
LLM03:2026Excessive Agency	5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.	145	107	142 in force, 3 not yet in force
	The 145 laws behind LLM03:2026 and 5.1.2-6 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	5.1.4-1Capability for human oversight designed in and maintained.	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind LLM03:2026 and 5.1.4-1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	5.2.1-1Full inventory of assets, including their dependencies and connections.	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind LLM03:2026 and 5.2.1-1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans...	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind LLM03:2026 and 5.2.4-1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	5.4.2-1Operators log system and user actions.	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind LLM03:2026 and 5.4.2-1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind LLM03:2026 and 5.2.2-5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	5.1.4-3Where oversight is a risk control, the technical measures behind it are built,...	4	2	2 in force, 2 not yet in force
	The 4 laws behind LLM03:2026 and 5.1.4-3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	5.2.4-2.1Minimum record for training data: its source, such as a page URL, and when it was collected.	3	3	3 in force
	The 3 laws behind LLM03:2026 and 5.2.4-2.1 Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany
	5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.	2	2	2 in force
	The 2 laws behind LLM03:2026 and 5.1.3-2 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	5.3.1-1Users told where and how their data is used, accessed and stored, with developers...	2	2	2 in force
	The 2 laws behind LLM03:2026 and 5.3.1-1 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	5.3.1-2.1That guidance covers proper use, limits and likely failure modes.	2	2	2 in force
	The 2 laws behind LLM03:2026 and 5.3.1-2.1 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.	2	1	2 in force
	The 2 laws behind LLM03:2026 and 5.1.3-1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
LLM04:2026Supply Chain	5.1.2-2System built to hold up against adversarial attacks, unexpected inputs and failures.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM04:2026 and 5.1.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM04:2026 and 5.1.3-1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.2.1-4Sensitive data such as training and test sets protected from unauthorised access.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM04:2026 and 5.2.1-4 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.4.2-2Logs analysed for anomalies, breaches and effects of drift or poisoning.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM04:2026 and 5.4.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
LLM05:2026Data and Model Poisoning	5.1.2-2System built to hold up against adversarial attacks, unexpected inputs and failures.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM05:2026 and 5.1.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM05:2026 and 5.1.3-1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.2.1-4Sensitive data such as training and test sets protected from unauthorised access.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM05:2026 and 5.2.1-4 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	5.4.2-2Logs analysed for anomalies, breaches and effects of drift or poisoning.	3	2	2 in force, 1 not yet in force
	The 3 laws behind LLM05:2026 and 5.4.2-2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy

Not connected to the ETSI EN 304 223: 5 of OWASP LLM Top 10's controls

No law we track reaches these

No duty in the laws we track reaches these controls.

LLM06:2026 Unbounded Consumption
LLM07:2026 Misinformation
LLM08:2026 Hidden Context Exposure
LLM09:2026 Vector and Embedding Weaknesses
LLM10:2026 Improper Output Handling

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.

Sources and licenses

OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.